BinSoft mpGabinet Client-Side Authentication Bypass Vulnerability Allowing Arbitrary User Login

A vulnerability exists in BinSoft mpGabinet versions through 23.12.19 that allows client-side authentication to be bypassed. An attacker with access to any application instance connected to the backend server can manipulate the application binary to circumvent the login verification process and authenticate as any user. This issue arises from the application's reliance on client-side authentication, which can be exploited by modifying the application binary to bypass login checks.

Impact

Exploitation of this vulnerability allows for unauthorized authentication, enabling an attacker to log in as any user on the affected application instance.